I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that all users attempting to access www.domain.com com will be directed elsewhere. My packet looks like so,
Answer: ???.domain.com A IN x.x.x.x
Authority RR: domain.com NS IN ns www.domain.com
Additional RR: www.domain.com A IN x.x.x.x
My problem is that my victim DNS server is cacheing the address www.domain.com as additional information but not using it when I query the server for www.domain.com. Instead it goes out and fetches the correct records. The DNS server is on my LAN on a VM. It is bind9, I believe 9.9. I have tried turning off dnssec, port randomization is off, my thought is that there has been enough time for bind to patch up the server good enough to avoid this particular exploit. Any thoughts or suggestions? Should I try an older version of bind? I started this project to learn more about DNS and I have learned a lot, but now that I've gotten to this point it is just frustrating. If you want to see anything from my setup I should be able to pull that up for you. Thanks in advance for any advice.
I guess a better way of asking this without saying "help me hack this thing" are what kinds of security measures have been put into place to patch the Kaminsky bug? Particularly on bind9, but in general is good too.